Retention Manager User Documentation 


This is user documentation on how to use the Retention Manager application in the 
Palantir Gotham workspace. 


TABS - MASTER, CREATE, REVIEWED 

There are currently 4 views of the Retention Manager: 

• Master - see cases coming up for purge, as well as accompanying information 
to help decide whether to approve for purge or dig deeper. Also contains 
search functionality. 

• Create - queue objects up for hard delete by associating existing objects to a 
Retention Case object type with a purge date and justification. 

• Edit - edit what gets deleted by modifying the a case’s object web. Delete 
links and recompute the web until it looks ready, then finalize it by 
approving and publishing changes to base realm. 

• Reviewed - cases queued up for purge. Cases will be cleared on a monthly 
basis. 


REVIEWING CASES 

When the Retention Manager is opened, you will find yourself in the Master view 
that allows you to see the cases coming up for purging, as well as some 
characteristics and flags (more below] to help you make a decision whether to 
approve it for purge or to explore further. 

The current processing logic looks at all objects linked to a case (SAR, EPAK, AdHoc, 
Case Support] in any way, whether one link or X links away. All objects will be 
subject to hard delete. 

In the event that you want to preserve an object, you will have to "delink” the object 
from the web and publish the delinking. See the "Edit” section for more information. 


To explore an object further, simply select the case you want to investigate, and then 
click the "Add To Graph” button. 



If everything looks good, click on the "Mark as Reviewed” and the case will be 
cleared from the queue. 

If at anytime you want to reverse your decision or see the cases already marked as 
reviewed, you can click on the Reviewed tab to view them. 
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NCRIC Flags 

In the Master and Reviewed views, you will find that each case has accompanying 
flags that tell you at a glance some of its characteristics that might warrant further 
investigation. 

The flags set for NCRIC are: 


• RMS - cases linked to objects sourced to Data Sources that contain the string 
"RMS” in the Data Source name or Data Source property on the object. 

• Case - cases linked to other cases [SAR, EPAK, AdHoc, Case Support] that will 
be subject to retention requirements. In any given web that has multiple 



























cases subject to retention requirements, the earliest purge date will be 
respected. 

• ALPR - cases linked to objects that are of object type ALPR Hit. 

• TSC - cases linked to objects that have a Request Type property equal to the 
value of "Tsc Hit" 

• Large - cases linked to more than 100 objects in the web. The "purge size” 
will be listed as "Large” and the flag fields will be"?” as the DART backend 
job didn’t parse through the entire web. Clicking "Add to Graph” will not 
show you all items. You should do search arounds until you get the full web 
and/or decide to delink objects at critical nodes to limit the expansion of the 
web. 
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EDITING CASES 

In the Edit tab, you can edit and recompute what is being deleted. Changes are 
staged in your investigation and are not pushed to base realm until you click the 
"Review and Publish” button. 

• Delete Selected Links - select one or more links and delete them. This 
deletes the actual link between the objects and doesn’t just remove them 
from the graph. You need at least Write access on the whole link in order for 
this to be successful. You will get an error message if link deletion failed. You 
might need to increase your Investigative Authorization in order to delete 
the links. 

• Add Selected Case - select the case that you want to edit. You need to select 
exactly one object of the appropriate retention object type. You will get an 
error message if it fails to get added. 

• Compute - for the case selected, compute the new web and see what objects 
are slated to be deleted. Note: as mentioned above, all objects linked to a 
case [whether 1 hop or X hops away], will be subject to this computation. If 
the web is extraordinarily big, the computation time might be significant. 

• Review and Publish - once you feel comfortable with the changes and with 
the details in the compute section, click this button to publish all changes and 
mark the case as approved. This step also reruns the Compute function and 
checks what to delete based on the current mapping of the objects. 




Conflict Flag Buttons - click on the conflict flag buttons to select all object 
that belong to that flag. 
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When editing a case, here are some tips on how to best manage the web: 

• Make sure that your investigative authorization is maximized. 

• Disentangle the web one Searcharound at a time, to remove highly linked 
objects as soon as possible. 

• Use the graph layout tool in the Graph to help identify objects to delete 




Auto 

Automatically layout the graph nodes (F5) 


Hierarchical 

Organize nodes into a hierarchy 


Circle 

Arrange graph nodes into a circle {F8) 


Sorted Linear 

Sort graph nodes into a straight line 


Minimal Crossing 

Arrange with minimal crossing of lines 

III! 

Grid 

Arrange graph nodes into a grid (F6) 

k 

Elbows 

Adjusts the elbows between nodes. 


• Use the selection tool in the Graph to help quickly select links to delete 




Select All Nodes Ctrl+A 

Select Orphan Nodes Alt+F12 

Select Nodes Added by Last Search Ctrl+Alt+F12 

Set Node Selection to Next Linked Level F12 
Expand Node Selection to Next Linked Level Ctrl+F12 
I nvert Node Selection Ctrl+F11 

Select all Text Boxes 
Select All Nodes of the Same Color 
Select All Edges of the Same Color 


Select All Links 

Select Links from Selected Nodes 
Invert Link Selection 


Ctrl+Shift+A 

CtrKShift+F12 

Ctrl+Shift+F11 


Clear Selection 
Restore Selection 


Escape 

CtrKShift+Z 















CREATING CASES 


If you want to queue objects up for purge, the steps are as follows: 

• Go to the Create tab. 

• Add the relevant objects to the helper using the "Add Selected Objects To 
Case” button. 

• Fill in details on the desired Case Label title for the Retention Case, as well as 
accompanying justification and purge date. These are required fields. 

• When ready, you can click "Create Retention Case" to create a Retention Case 
which will be linked to all the objects. 

o This is not the final step. If you find that you made a mistake, simply 
delete the Retention Case. It has not been published to the base realm 
yet. 

• Review ah objects to make sure that everything is in order. Once ready, 
click "Publish Selected Cases” to queue them up for deletion. 

• You can now click "Reload” on the Review panel and the new Retention Case 
should show up. Or you can search for the Retention Case using the search 
field. 



